Generative modeling uses patterns learned from existing data to create new content, such as text, predictions, or realistic synthetic datasets. In cybersecurity, that can mean drafting a metrics report or simulating events for analysis. It differs from traditional AI used chiefly to identify patterns, assess risks, or make predictions from existing data. section 13.1 section 12.1.1
A practical workflow starts with a structured prompt to a language model. Parse its output into a Pandas DataFrame, analyze categories or trends with Python, then chart or report the results. The generated data supports testing and planning; it is not evidence that the simulated events actually occurred. section 13.6 section 13.6.1
Figure 13.1 AI synthetically generated pipeline
The pipeline connects prompting, synthetic data generation, DataFrame analysis, and a chart or report. section 13.6
Investigate failed-login patterns
Generate fictitious failed-login records with user ID, login hour, device type, and failure reason. A bar chart of reasons can show whether incorrect passwords dominate the sample, suggesting a question for user education or password-policy review. Validate the pattern against relevant evidence before treating it as an organizational finding. section 13.6.1 section 13.9
Other useful applications include:
- Draft incident classifications, priorities, and response recommendations alongside an incident-frequency chart. section 13.8.1
- Turn sample metrics into executive summaries or dashboards, or simulate incidents for training and response exercises. section 13.9.2
Treat every output as a proposal for human review. Training-data patterns can produce incomplete, misleading, or biased recommendations, and a model cannot determine the meaning of failed logins without context. Check accuracy and trend significance, anonymize sensitive inputs, and consider a local model when third-party processing would create privacy risk. section 13.10 section 13.9
